Who is Uways Qarani?
The hacker group Uways Qarani has been recently identified by cybersecurity firms as an emerging threat. Its name references Uways al-Qarani, a 7th-century Muslim mystic revered by some Islamic currents, suggesting a possible ideological or religious motivation.
According to technical analysis, the group openly declares its affiliation with Ansar Allah, also known as the Houthis, the political-military movement that has controlled much of Yemen since 2014. This connection, though not independently confirmed, is taken seriously by analysts due to the history of cyber attacks attributed to actors linked to Iran and proxy groups in the Middle East.
Declared targets: critical infrastructure
Uways Qarani has stated its intention to attack critical infrastructure, a term that covers vital sectors such as power generation and distribution, water treatment plants, transportation systems, and communication networks. These targets are especially sensitive because their disruption can cause physical, economic, and social damage on a large scale.
Experts warn that the group has shown particular interest in PLC (Programmable Logic Controllers) and SCADA (Supervisory Control and Data Acquisition) systems, which are the brains of industrial automation. A successful attack on these systems could allow attackers to manipulate physical processes, such as opening or closing valves, altering temperatures, or disrupting electricity supply.
What are PLC and SCADA? PLCs are electronic devices that control machinery and industrial processes. SCADA is a software system that supervises and controls these devices centrally. Together, they form the backbone of automation in factories, power plants, and other critical facilities.
Observed tools and tactics
Analysis of the group's operations reveals the use of specialized tools designed specifically to interact with PLC/SCADA environments. This indicates a considerable level of technical knowledge and meticulous preparation, raising the alert level among cybersecurity professionals.
Observed tactics include exploiting known vulnerabilities in industrial protocols, using custom malware, and conducting targeted phishing campaigns against employees of infrastructure companies. Although no mass attacks have been reported so far, the mere existence of these capabilities is a cause for concern.
Geopolitical context and background
The alleged link to Ansar Allah is not coincidental. Yemen has been the scene of a devastating conflict since 2014, with intervention by a Saudi-led coalition. In recent years, the Houthis have launched missile and drone attacks on oil facilities and airports in Saudi Arabia and the United Arab Emirates, but their cyber activity has been less documented.
However, in 2021, a group calling itself "Al-Taif" claimed attacks on infrastructure in Saudi Arabia, and speculation arose about its relationship with the Houthis. Uways Qarani could be an evolution or a new actor in this landscape, though analysts do not rule out that it might be a false flag operation or an independent group seeking notoriety.
Recommendations for companies and governments
In light of this threat, experts recommend that critical infrastructure companies strengthen their security measures, including network segmentation, patch updates, implementation of multi-factor authentication, and periodic audits. They also suggest creating incident response teams and sharing information with government agencies.
Governments, for their part, should consider cyber defense as a strategic priority, especially in a global context where attacks on infrastructure are increasingly frequent. International cooperation is key to tracking and neutralizing these actors.
In summary, Uways Qarani represents a new piece in the complex chessboard of modern cyber warfare. Its alleged affiliation with Ansar Allah and its focus on industrial systems make it an actor to watch closely. The international community must remain alert and prepared to respond to potential attacks that could have devastating consequences.
Sources: Cybersecurity analysis from specialized media, intelligence reports, and tracking of hacktivist groups.